Recently, packets flowing in a packet communication network are captured (i.e., acquired) in various fields. For example, packets are captured to monitor an IP (Internet Protocol) network and to control the quality of VoIP (Voice over Internet Protocol). Especially, in these years, the market scale of the VoIP service (for example, an IP telephony service) in Japan, and the market scale of the VoIP equipment of domestic corporations in Japan have made a remarkable growth, and are expected to make a further growth at a high rate. Therefore, the importance of the VoIP quality control system has been highly evaluated.
Furthermore, depending on the purpose of the packet capture, “full capture” is performed. The full capture means to fully capture all packets that flow through a point to be monitored in a network. The full capture is performed by, for example, forensic products. Some IP network monitor systems and some kind of VoIP quality control may naturally involve a full capture device.
One of the factors affecting the quality of communications by the VoIP is a fact that a fluctuation (also referred to as a jitter) in an interval between packets, which are transmitted regularly, is caused at a destination due to the influence of a network. Therefore, for example, the quality of the communications through the VoIP may also be monitored by providing a monitor device in advance on a network path where calls are concentrated, by capturing all packets relating to the communications whose quality is to be measured, and by analyzing the jitter in real time.
Furthermore, to control the quality of communications, not only the jitter, but also various amounts (such as the amount of traffic, a loss rate of packets, the delay time from a source to a destination, etc.) may be targeted to be measured. Some measurement targets may require the full capture. The comparison between the measured communication quality value and the control reference value that is set in advance by a network administrator or anyone else enables automatic determination of the communication state and monitoring of the packet communication network.
However, an expensive dedicated device may be required when it is attempted to use only one monitor device for realizing the full capture and for making an analyzing process in real time continuable even if the number of communications becomes large. The reason is that the capacity of a buffer memory provided in a general-purpose monitor device and the processing capability of a CPU (central processing unit) provided in a general-purpose monitor device may be insufficient to cope with the amount of communications at the peak, and therefore may fail to guarantee the full capture and the analysis in real time. For example, when a general-purpose monitor device is used, there may occur capture failure due to a buffer overflow when there are a large number of communications.
Therefore, to realize the full capture without an expensive device, it is considered to capture a large number of IP packets by sharing the capture among a plurality of devices.
For example, a traffic gathering/analyzing system is proposed that includes a plurality of traffic gathering/analyzing devices and sharing adjustment means. The plurality of traffic gathering/analyzing devices are connected on the same network segment and each gathering/analyzing device is provided with traffic gathering/analyzing means. Furthermore, the sharing adjustment means adjusts the sharing among these traffic gathering/analyzing means. The sharing adjustment means controls each traffic gathering/analyzing means so that these traffic gathering/analyzing means share the gathering and analysis of the traffic on the network segment without fail.
In the traffic gathering/analyzing system, for example, a method is used in which time synchronization among the traffic gathering/analyzing devices is performed, a time period for gathering the traffic is assigned to each gathering process (i.e., each gathering object), and thereby the sharing is determined. That is, each gathering process is determined to execute the gathering/analyzing processing only on the packets which pass through the segment in the assigned time period. In this case, in order to avoid an omission during handover, it is necessary to leave a margin (i.e., an overlap), which is sufficient with respect to the accuracy of the synchronization, between consecutive gathering times of the gathering objects.                [Patent Document 1] Japanese Laid-open Patent Publication No. 11-88328        